CVE-2024-27935

Summary

CVE-2024-27935 is a vulnerability affecting Deno, a JavaScript, TypeScript, and WebAssembly runtime, between versions 1.35.1 and 1.36.3. This issue involves Deno's Node.js compatibility runtime, which allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The root cause is the reuse of a global buffer (BUF) in stream_wrap.ts, leading to data from one session being received by another, potentially resulting in data corruption and unexpected behavior. Users of Deno who utilize the node.js compatibility layer for network communication or other streams, including indirectly through packages, are at risk. Deno release 1.36.3 includes a patch to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.